Privacy Policy

Version 1.0 · Prepared 19 September 2026 · Effective on publication

How Aurelua collects, uses, shares, protects and retains personal information.

1. Who is responsible

Aurelua, registration number 2026/344331/07, is the responsible party for personal information it determines how and why to process through the Platform. Address: 282 Tryall Road, Milnerton Rural, Cape Town, 7441, South Africa. Email: info@aurelua.com. Telephone: +27 21 879 6453.

The Head and Information Officer is the Chief Executive Officer. The Information Officer’s registration status must be kept current with the Information Regulator.

2. What we collect

• Identity and contact. Name, email, mobile number, date of birth where needed, address, identity or business registration evidence.
• Account and role. Login identifier, password hash, Buyer or Seller role, permissions, verification status, preferences and account history.
• Seller and store. Business details, store name, product listings, images, social links, licences, tax status and evidence of authenticity and source.
• Orders and delivery. Products, price, fees, order messages, recipient, address, courier, tracking, delivery status, returns, disputes and refunds.
• Payments and payouts. Payment reference, method, amount, status, masked instrument details, bank-account details, verification and settlement records. This includes your South African identity number, or your business registration number, where we use it to confirm that the bank account you gave us belongs to you. Aurelua does not intentionally store a full card number or CVV when the Payment Provider collects it.
• Identity verification. ID document details, selfie and liveness result, and facial-comparison data processed through Didit, plus Aurelua’s verification reference, result and date.
• Device and activity. IP address, device and browser, timestamps, session and account actions, pages, referring source, approximate location, cookie identifiers, fraud and security signals.
• Communications. Support requests, complaints, survey responses, call or message records and marketing choices.
• Derived records. Risk flags, eligibility status, dispute outcome, abuse prevention, and audience and measurement events.

3. How we obtain information

• directly from you when you visit, register, verify, list, buy, sell, pay, request a payout, contact support or exercise a right;
• from the other party to an Order, a courier, Payment Provider, identity-verification service, bank-verification service or social integration you choose;
• automatically from the Platform, cookies, local storage, logs and security tools; and
• from lawful public, fraud-prevention, company or identity sources where verification is necessary and proportionate.

4. Why and on what grounds

• Create and operate accounts and stores. To perform the user agreement, take requested pre-contract steps and protect legitimate account interests.
• Process Orders, payment instructions, payouts, delivery, returns and disputes. To perform relevant contracts, meet legal duties and protect the legitimate interests of Buyers, Sellers and Aurelua.
• Verify Sellers, identity and bank details. To prevent fraud, protect users, comply with provider and legal requirements and, where biometric information is used, on explicit consent or another lawful authorisation.
• Provide support and communicate service messages. To perform the service, answer requests and keep necessary evidence.
• Secure the Platform and enforce rules. To protect legitimate interests, comply with law and establish, exercise or defend legal claims.
• Improve features and measure performance. With consent where non-essential tracking is involved, or using necessary or aggregated information where lawful.
• Send electronic direct marketing. With consent for a prospective customer, or to an existing customer for Aurelua’s own similar services where POPIA permits, always with a free opt-out.
• Meet company, tax, consumer, payment and regulatory duties. To comply with law and maintain required records.

Where information is needed to create an account, complete an Order, verify a payout or meet a legal requirement, refusing it may mean Aurelua cannot provide that function. Optional marketing, analytics and social permissions can be refused or withdrawn without losing core service access, although related optional features may stop.

Special personal information. Biometric information is prohibited from processing under section 26 of POPIA unless an exception in section 27 applies. We rely on your consent, given when you choose to start identity verification.

5. Payments

Payment Providers such as Paystack and Ozow process supported payment methods as actually enabled at checkout. They may receive identifiers, amount, order reference, payer details, device and fraud data, and payment credentials. Payment credentials entered into a provider-hosted field are controlled by that provider under its own notice and payment rules.

Aurelua receives transaction status, reference, masked details and information needed for reconciliation, refunds, disputes and fraud controls. Sellers’ bank details may be sent to a provider or bank-verification service for payout and account checks. Where we check that a Seller’s bank account belongs to them, we send the account number, the account holder name, and the Seller’s identity or business registration number to Paystack, which returns only the result of that check.

6. Seller verification and biometrics

Didit may collect an identity document, selfie, liveness result and facial-comparison data to verify a Seller. Aurelua does not store your identity document or your selfie. They are captured by Didit, who processes them on our instruction. Aurelua ordinarily keeps only the verification reference, the result and the date, rather than the raw biometric template. Nobody at Aurelua sees your document, and it is never shown to a Buyer.

Aurelua remains the responsible party for the material Didit holds on our instruction. Didit retains verification material only for the configured period needed for verification, security and legal purposes. Aurelua’s disclosed maximum is one year, after which Didit deletes it, and Aurelua periodically reviews whether a shorter period is sufficient. You can ask us to delete a verification sooner, including the document and selfie held by Didit, at any time by contacting our Information Officer below.

A Seller may withdraw consent for future biometric processing, but this does not invalidate processing already lawfully completed. If Aurelua cannot verify identity by another proportionate method, verification, selling or payouts may be unavailable. Verification is a condition of being paid at the moment a Buyer pays rather than after delivery (see our Terms of Use), so if you choose not to verify, your sales are held until the Buyer confirms delivery instead. A person may request human review of a failed or disputed result.

7. Buyer and Seller data roles

Aurelua shares the minimum Buyer information a Seller needs to fulfil and support an Order. For its own use of that information, the Seller may be a separate responsible party under POPIA. It may not use Buyer details for unrelated marketing, resale, profiling or contact without a lawful basis and proper notice.

Aurelua requires Sellers to protect Buyer data, limit access, report compromises, assist with rights and delete or de-identify information when no longer lawfully required. Buyers should avoid placing unnecessary sensitive information in messages or delivery instructions.

8. Cookies, analytics and advertising

The Platform uses necessary technologies for security, sessions, preferences and core functions. Subject to the user’s choice, it may use PostHog for product analytics and Meta technologies for advertising measurement and audience functions. The Cookie Notice explains the categories and controls.

Aurelua does not activate non-essential analytics or advertising technologies before consent. A user may withdraw consent through cookie settings. Session replay is not used unless it is specifically enabled following an impact assessment, sensitive fields are masked and checkout, identity and private-message content are excluded. If enabled, it will be identified in this Policy and the Cookie Notice.

Where enabled and consented to, Meta may receive browser events, IP address, device and browser information, cookies and hashed identifiers such as email or telephone number. Purchase or product detail must not be sent unless the approved data map, consent and notice specifically cover it.

9. Who receives information

• Buyers and Sellers. Order formation, fulfilment, communication, delivery, returns and disputes. Access is limited to what is needed.
• Paystack, Ozow and other enabled Payment Providers. Payment, verification, payout, refunds, fraud, chargebacks and compliance. The exact live providers must match checkout.
• Didit. Identity, liveness and facial comparison for Seller verification, with special-information controls.
• Couriers and logistics providers. Addressing, tracking, delivery, collection and claims.
• Resend and communications providers. Transactional email and service communications.
• Vercel, Render, Cloudflare R2 and Neon. Hosting, storage, delivery, database, resilience and security as actually configured.
• Advertising and measurement (Meta, which runs Facebook and Instagram). Consent-based advertising measurement and audience tools. Two things are sent. From your browser, the pages and actions that matter to an advert, along with your IP address, your browser user agent, and Meta’s own cookies. From our servers, when you register or place an order, the same event plus your email address, phone number, name and your Aurelua account id, each one hashed (turned into an irreversible digest) before it is sent, so Meta can recognise an existing user of its own without us handing over the plain details. We never send your identity document, your bank details, or what you bought from a specific seller in a form that identifies you to anyone else.
• Product analytics (PostHog). Consent-based page and product-usage events and, only if specifically enabled and assessed, session-replay functions. Once you sign in, this includes your email address and whether you are a Buyer or a Seller, so the activity belongs to an account rather than to an anonymous device. Used to understand and improve the product, never sold.
• Anthropic and AI service providers. Only information necessary for an expressly used AI-assisted function. Identity, payment and unnecessary personal data must not be submitted.
• Professional advisers, insurers and authorities. Advice, audit, claims, law enforcement, court orders and legal or regulatory duties.
• A business successor. A genuine financing, restructuring or sale, subject to confidentiality, due-diligence minimisation and continued protection.

Aurelua does not sell your personal information for money. It must maintain written operator terms where a provider processes personal information on its instructions. You can ask us to stop the advertising and measurement sharing described above at any time, and you can object to it under your POPIA rights below.

10. International processing

Some providers may process information in the European Union, United States or other countries. Aurelua must transfer personal information outside South Africa only where section 72 of POPIA permits. For example, where the recipient is subject to adequate law or a binding agreement providing an adequate level of protection, where the person consents, or where another statutory ground applies.

11. Automated decisions

Automated signals may help detect fraud, prioritise review, verify identity or decide whether a transaction or payout needs a hold. Aurelua does not make a decision that has a legal or similarly significant effect solely by automated processing unless POPIA permits it and appropriate safeguards apply.

A person may ask for an explanation, submit relevant information and request human reconsideration of a materially adverse verification, suspension or payout decision.

12. Retention

• Account and core profile. While active and ordinarily five years after closure, unless a shorter period is sufficient or a longer legal or claim period applies.
• Orders, payments, payouts, invoices, returns and disputes. Ordinarily five years after the transaction or closure of the matter, subject to tax, company, consumer, payment and claim requirements.
• Identity-verification result and reference. For the period needed for fraud, payout, legal and claim purposes, reviewed annually.
• Raw Didit verification material. A provider-controlled period as configured and disclosed, never longer than the stated one-year maximum. Aurelua reviews the need annually and seeks earlier deletion where the material is no longer required.
• Security and technical logs. Ordinarily 90 days, extended where needed for an incident, fraud, dispute or legal hold.
• Support and complaints. Ordinarily three years after closure, longer where tied to an Order or claim.
• Marketing record. Until opt-out or withdrawal, plus a minimal suppression record so the opt-out is respected.
• Cookie consent evidence. For the period needed to demonstrate the choice, then deleted or de-identified.

These periods are maximum working rules, not a reason to keep every field. Aurelua must delete, destroy or de-identify information when the purpose and legal retention period end, unless a lawful hold applies.

13. Security and incidents

Aurelua uses reasonable technical and organisational measures appropriate to the risk, including encrypted transport, access controls, password hashing, restricted administrative access, backups, logging, vendor review and incident procedures. No system is risk-free.

An operator must notify Aurelua immediately of suspected compromise. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, Aurelua will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to POPIA and any lawful delay direction.

14. Your rights

You may:

• ask whether Aurelua holds personal information about you and request access;
• ask for inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information to be corrected, deleted or destroyed as POPIA allows;
• object to processing on the grounds POPIA provides;
• withdraw consent for future consent-based processing;
• opt out of direct marketing at any time and without charge;
• ask for human review of a significant automated outcome; and
• complain to Aurelua or the Information Regulator.

Send a request to info@aurelua.com. Aurelua may need to verify identity and may ask for the prescribed PAIA form where access to a record is requested. See our PAIA Manual for that process. Aurelua will respond within the period required by applicable law. POPIA does not create a universal 30-day deadline for every type of request.

15. Children

The Platform is for people aged 18 or older. Aurelua does not knowingly permit a child to open a Buyer or Seller account. If Aurelua learns that it processed a child’s information without a lawful basis, it will restrict and delete it as appropriate.

16. Changes

Aurelua may update this Policy to reflect law, providers, features or processing. Material changes will be highlighted or notified before they take effect where reasonably possible. The version and publication date are kept at the top of this page.

17. Contact and complaints

Information Regulator (South Africa). Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg. PO Box 31533, Braamfontein, Johannesburg, 2017. Telephone 010 023 5200. Email enquiries@inforegulator.org.za. Complaint contact details and forms are available at inforegulator.org.za.

Aurelua is on Instagram at @_aurelua, for updates only. Privacy and POPIA requests go to the Information Officer above.